Eww, eww, make it go away. From /usr/lib/xen-tools/debian.d/20-setup-apt:

> #
> # If the host system has security support then enable that here too.
> #
> if ( grep ^deb.*security.debian.org /etc/apt/sources.list >/dev/null 2>/dev/null ) ; then

If that doesn't match, it adds in the security sources commented out.

This is totally a bug in xen-utils, both because the hooks may not be running on a Debian system, and because you probably never want a system running without the security repo enabled.

The issue with the Ubuntu installers is separate - someone just forgot to mention multiverse in several different places in /usr/lib/xen-tools/edgy.d/20-setup-apt (which is different from the Debian one)

Essentially, the grep command in the if statement has been changed from
> if ( grep ^deb.*security.debian.org /etc/apt/sources.list >/dev/null 2>/dev/null ) ; then
to
> if ( grep -E '^deb.*security\.(debian\.org|ubuntu\.com)' /etc/apt/sources.list >/dev/null 2>/dev/null ) ; then

This has been tested with the etch autoinstaller (it's actually in the current image). Note, however, that the Hardy issue has not been addressed.